Hello, and welcome to the Q3, 2021 CyberArk Software Limited Earnings Conference Call. All lines have been placed on mute to prevent any background noise. After the speaker's remarks, there will be a question and answer session. If you would like to ask a question during this time, simply press star then one on your telephone keypad. If you would like to withdraw your question, press the pound key. Thank you. I would now like to turn the call over to Miss Erica Smith. Please go ahead, ma'am. Thank you, Lisa. Good morning. Thank you for joining us today to review CyberArk's third quarter 2021 financial results. With me on the call today are Udi Mokady, Chairman and Chief Executive Officer, and Josh Siegel, Chief Financial Officer. After prepared remarks, we will open the call up for a question and answer session. Before we begin, let me remind you that certain statements made on the call today may be considered forward-looking statements, which reflect management's best judgment based on currently available information. I refer specifically to the discussion of our expectations and beliefs regarding our projected results of operations for the fourth quarter in the full year of 2021. Our actual results might differ materially from those projected in these forward-looking statements. I direct your attention to the risk factors contained in the company's annual report on Form 20-F filed with the U.S. Securities and Exchange Commission, and those referenced in today's press release that are posted to CyberArk's website, as well as risks regarding our ability to actively transition the business to a subscription model, the duration and scope of the COVID-19 pandemic, its related impact on global economies, and our ability to adjust in response to the COVID-19 pandemic. CyberArk expressly disclaims any obligation or undertaking to release publicly any updates or revisions to any forward-looking statements. Additionally, non-GAAP financial measures will be discussed on this conference call. Reconciliations to the most directly comparable GAAP financial measures are also available in today's press release, as well as in an updated investor presentation that outlines the financial discussion in today's call. We also wanna remind you that we provide the calculated headwind calculation for additional color on the impact of our subscription bookings mix shift but it should not be used as comparable to or a substitute for reported GAAP revenues or other GAAP metrics. A webcast of today's call is also available on our website in the IR section. With that, I'd like to turn the call over to our Chairman and Chief Executive Officer, Udi Mokady. Udi? Thanks, Erica, and thanks everyone for joining the call. Q3 was another amazing quarter, and we are thrilled with our results. If I could use only one word to characterize this quarter, it would be acceleration. Acceleration in the demand environment, in the underlying growth of the company, specifically bookings, and in the metrics that demonstrate the health of the business. As examples, subscription ARR growth accelerated to 131%, reaching $139 million. Total ARR growth accelerated to 38%, reaching $344 million. Recurring revenue growth accelerated to 41%, reaching $89 million. New logos added during the quarter accelerated to over $230 million. Our standout performance in Q3, following an incredible second quarter, was again driven by record SaaS bookings, record total bookings, the execution of our subscription transformation, and robust demand for our identity security platform centered on privileged access management. Customers are embracing the subscription model as evidenced by 72% of new license bookings coming from SaaS and subscription in the third quarter, ahead of our guidance framework. Even with the revenue headwind from this mix, we generated total revenue of $122 million above our midpoint, demonstrating again that our bookings were considerably higher than anticipated in our guidance. One way to think about the growth of the business is to isolate the license line adjusted for the calculated revenue headwind. This would represent license growth of faster than 50% year-over-year, which is indicative of our overall growth. Simply put, it was a stellar quarter. As we have talked about throughout the year, our subscription mix, ARR, and recurring revenue demonstrate the progress in the subscription transition and the strong demand for our SaaS solutions in particular. The four pillars of growth, subscription transition, innovation, and profitability provide a great backdrop for today's discussion. Let me start with growth. I love starting here because our growth trajectory has never been stronger. Excellence in our execution and the strong secular tailwinds of digital transformation, cloud migration, and attacker innovation contributed to the acceleration in our business. With the acceleration in attacker innovation, our customers now contend with operator-driven ransomware, malware-as-a-service, and attacks on automation and supply chains and the DevOps pipeline. It is no longer enough to have an assumed breach mindset. Instead, enterprises have to dig deeper and take an assumed identity posture. They recognize that every identity across human users, applications, and bots can be privileged under certain conditions. It is easy to see why customer and prospect interest in our solutions is at an all-time high. Looking at our geographies, we had another perfect game across our major territories. When you adjust for the calculated revenue headwind, every region grew total revenue by over 27%, with license revenue obviously growing even faster across the Americas, EMEA, and APJ, which Josh will talk about more. New business accelerated, and we added more than 230 marquee customers, as I mentioned, from law firms to software companies, oil and gas to retailers, to large government agencies. We won customers across the spectrum, demonstrating that every organization, regardless of size or vertical, needs our identity security platform. We typically land with PAM, and momentum for Privilege Cloud continues to build both in the mid-market and much deeper in the large enterprise. In fact, in the third quarter, a Fortune 30 company signed our largest annual contract for Privilege Cloud ever. A great win that demonstrates the increased adoption we are seeing in our enterprise customer base. With our subscription model resonating and SaaS taking off, customers are adding both more users and more products faster. For customers with large self-hosted footprints, they are expanding with Privilege Cloud to secure new business units, the DevSecOps pipelines or applications. Endpoint Privilege Manager, or EPM, had another record quarter as the crippling effects of ransomware continue to drive demand. Not only is EPM an expansion opportunity within our customer base but it is also proving to be a great landing spot for new logos like a large food retailer, a born-in-the-cloud software company, and a large local school system, to just name a few of the Q3 wins. The increased focus on specialized resources from the access and DevSecOps speed boats continued to pay off this quarter. Productivity levels increased in all regions, and our cross-sell activity has improved considerably. Access had another strong growth quarter in Q3, with both exciting enterprise wins in our base and a broader set of customer wins in our commercial and emerging markets. I will talk more about our innovations in a few minutes but identity security, where access is tightly aligned with PAM, is differentiating CyberArk with customers. I want to highlight a few more customer examples from the third quarter. In a highly competitive deal, an existing financial services customer wanted the benefits of our identity security platform and will be replacing a legacy access solution with CyberArk Identity. A new financial services customer will be using Privilege Cloud and Conjur to secure secrets. This organization recognized that securing both human and non-human access was critical, particularly as every company becomes a de facto software company. Our ability to secure applications anywhere is giving us a nice competitive edge in the DevSecOps space. A high-profile pharmaceutical company bought Privilege Cloud, but more importantly, is committed to implementing a comprehensive identity security program and PAM is just the first step. A large insurance company expanded with every one of our solutions. They began their journey with CyberArk in 2010, expanding their privileged access program along the way. In Q3, they went deep and broad with CyberArk, embracing our identity security platform, buying Secrets Manager, Privilege Cloud, Remote Access, Endpoint Privilege Manager, Workforce Identity, and Cloud Entitlements Manager. We pride ourselves on our culture, building strong lasting relationships, and putting the customer at the center of everything we do. This win demonstrates the power of our portfolio and it shows the criticality of our relationships with enterprise customers. Our partner ecosystem is further extending our reach and driving scale in our go-to-market. Our certification programs have been stepping up as we focus more and more on leveraging our partners to drive growth. Year-to-date, through Q3, we certified close to 20% more professionals than we did in the full year 2020. This commitment to invest in comprehensive training programs is a testament to the opportunity and significant growth our channel partners expect. A number of our partners are going even deeper into identity security and acquiring companies, including The Herjavec Group and CDW making strategic acquisitions in our space. Next, I would like to focus on the subscription transition. We made strong progress and outperformed our expectations in the third quarter. Our transition continues to be driven by strong demand for our SaaS solutions and we reached another new record for SaaS bookings with particular strength in Privilege Cloud and Endpoint Privilege Manager. We have completed three quarters of our active subscription transition and the number of customers with over $100,000 in ARR is now more than 760, growing faster than 40% year over year. As we expected when we began the subscription journey, customers are getting faster type of value and prioritizing our platform which will result in higher lifetime value over time. We are thrilled with the progress of our subscription transition and with our success year-to-date, we are confident we will exit the transition by the third quarter of 2022. Our innovation pillar is the foundation of our strategy, continues to put more distance between us and the competition and further strengthens our leadership position. We announced earlier this week the general availability of Secure Web Sessions, a workforce and customer identity solution. Secure Web Sessions merges the worlds of access and PAM. We are now the only vendor in the market that can empower customers with continuous authentication and session protection, including session recording for all types of web applications from business apps to cloud consoles. We are pleased to see our innovation recognized by industry experts. We were named a leader in the Forrester Wave Identity as a Service for Enterprise, and an overall Privileged Access Management leader by KuppingerCole. Just yesterday, we announced that we were named the only visionary in the 2021 Magic Quadrant for Access Management. We believe we are the undisputed leader in PAM and are leveraging this position to extend our expertise into access. I will wrap up my discussion with some comments on the profitability pillar. As you have already seen from the acceleration in our business, our investments are paying off. The headwind on profitability from the subscription transition is obscuring the P&L. Given the strength of our bookings, which gives us more scale and our track record of delivering profitable growth, we are well positioned to return to strong profitability levels. To sum up Q3 quickly. Our business is accelerating on the back of record year-over-year bookings growth. SaaS is leading the way and reached a new record quarter this quarter. Privilege Cloud is pushing into the large enterprise, and EPM has moved into the mainstream security discussion. Our subscription transition is making strong progress. Our industry-leading identity security platform across PAM, Access, and DevSecOps has never been more relevant. I will now turn the call over to Josh, who will discuss our financial results in more detail and provide you our outlook for the fourth quarter and full year 2021. Josh, over to you. Thanks, Udi. Before we discuss the details of the quarter, we would like to remind you that we posted slides to the website that will be helpful as we walk through our results. As Udi mentioned, we had a great third quarter. Our license bookings growth meaningfully accelerated even in comparison to a strong Q2, 2021. We also made significant progress executing both our subscription transition and our identity security strategy. In terms of the headline P&L, we delivered total revenue of $121.6 million with a 72% mix of subscription bookings ahead of our guidance framework of our 70% mix. As you may remember from last quarter, revenue above the midpoint of our guidance and a higher subscription bookings mix demonstrates that our total bookings beat our expectations for the quarter. Subscription revenue, which includes our SaaS and on-premise subscription revenue, reached $35.3 million and represented 29% of total revenue in the third quarter, increasing, you know, 143% from $14.5 million and only 14% of total revenue in the third quarter last year. Our maintenance and professional services revenue was $63.3 million, with $53.6 million from recurring maintenance and $9.6 million in professional services revenue. We continue to have a strong renewal rates on our maintenance renewal business. Recurring revenue, which includes our subscription and maintenance related on perpetual license revenue, reached $88.9 million, or 73% of total revenue, growing 41% year-on-year from $62.9 million and 59% of total revenue in the third quarter last year. With a 72% mix of subscription bookings, it is clear the subscription transition is ahead of schedule. Economically, the headwind created by the mix was approximately $16 million in the third quarter when we compare like-for-like to the mix of the third quarter 2020. Normalizing for the mix shift, growth in the license portion of our business, our SaaS on-premise subscription and perpetual accelerated again in the third quarter to over 50% and is illustrative of the underlying growth in the business. Taking the calculated revenue headwind into consideration, total revenue growth accelerated to 29% year-on-year. Moving on to the annual recurring revenue. We experienced our largest ever sequential increase in the subscription portion, adding about $29 million in the third quarter and reaching $139 million, representing over 40% of the total. Our total ARR was $344 million, growing 38% year-over-year. That's an acceleration from the second quarter of 2021. The maintenance portion was $206 million at September 3rd. We had another great new business quarter both in terms of new logos and business trends. We signed more than 230 new customers with 85% of them opting for a subscription compared to about 59% in the third quarter of last year. New business deal sizes also increased again in the third quarter. Geographically, the business continues to be well-diversified. The Americas generated $68.2 million in revenue, representing 56% of total revenue. The Americas, again, had the strongest percentage of subscription bookings during the quarter. EMEA had $39.7 million in revenue, or 33% of total. APJ generated $13.7 million in revenue, or 11% of total revenue, with an increasing mix of SaaS and subscription. If we look across the geographies adjusted for the calculated revenue headwind created by the mix, each region would have grown by over 27% in total revenue with our license line growing even faster than 50% in the Americas and APJ and approximately 30% in EMEA. All line items on the P&L will now be discussed on a non-GAAP basis. Please see the full GAAP to non-GAAP reconciliation in the tables of our press release. Our third quarter gross profit was $102.5 million or an 84% gross margin, consistent with the 84% gross margin in Q3 last year. We continue to make investments to drive innovation and growth resulting in operating expenses of $102.4 million. That's a 34% increase year-on-year, and operating income was $130,000 in the quarter which was better than the midpoint of our guidance. It is important to remember that our operating income is lowered by about $1.5 million from FX rates and approximately $16 million of headwind. On a like-for-like basis, neutralizing the calculated revenue headwind and foreign exchange, our operating margin would have been approximately 12% in the third quarter of 2021. Over 70% of our operating expenses are related to headcount. In the third quarter, we surpassed 2,000 CyberArk employees, ending the third quarter with 2,075 worldwide. Of our total employee count, 925 are in sales and marketing. Net loss for the third quarter was about $2.4 million or $0.06 per basic and diluted shares. In the first nine months of 2021, free cash flow was $47.1 million or 13% free cash flow margin. This cash flow contributed to our strong balance sheet, and we ended the quarter with $1.2 billion in cash and investments. Turning to our guidance. Our guidance for the fourth quarter reflects the robust industry tailwinds, our record bookings, strong execution year-to-date, and improved productivity. For the fourth quarter of 2021, we expect total revenue of $140 million-$148 million. We expect a non-GAAP operating income of about $5.5 million-$11.5 million for the fourth quarter. We expect our EPS to range from non-GAAP net income of $0.06-$0.21 per diluted share. This guidance assumes about a 68% subscription bookings mix and a calculated revenue and profitability headwind of approximately $28 million for the fourth quarter of 2021. If you isolate our license lines of SaaS, on-premise subscription, and perpetual, the normalized growth rate, taking into account the calculated revenue headwind for the quarter, is about 24% year-on-year. Similarly, for the total revenue the growth rate would be about 19% at the midpoint of the range taking the headwind into account. Our guidance also assumes 41.7 million diluted shares. For the full year of 2021, we expect total revenue in the range of $491.6 million-$499.6 million. The mix assumption underlying our guidance for the full year is 65% from subscription bookings and our revenue headwind for the full year is now approximately $68 million. This represents an increase from our prior guidance which assumed a mix of 64% from subscription bookings and a $63 million headwind to revenue. Taking the calculated revenue headwind into account, our revenue growth rate would be approximately 22% at the midpoint of the range. If you isolate our license lines of SaaS and subscription and perpetual, the normalized growth rate is over 30% for the full year taking the calculated headwind into account. I wanna emphasize that increasing both our total revenue guidance and our mix indicates that we are again increasing the bookings assumptions underlying our guidance for the full year. This rate is above and beyond the bookings fee in the third quarter. Now, moving down the P&L. We expect non-GAAP operating income to be between $13.1 million to $19.1 million. We expect our non-GAAP net income per diluted share to be in the range of $0.11-$0.25. For the full year, we expect about 40.9 million weighted average diluted shares and about $13.5 million in taxes. We wanted to briefly mention our current thoughts on the timing of the transition and on ARR growth. Given our success year-to-date, we expect to exit the transition earlier, and we now expect to complete the transition in the third quarter of 2022 versus the fourth quarter of 2022, as we outlined in our August call. Also, given the acceleration of our growth and our record bookings this year, we expect annual recurring revenue to grow about 37% year-on-year. That's an increase from our prior framework of 35%. The third quarter was a great quarter and another important step in the execution of our subscription transition and our identity security strategy. Our business is accelerating, which you see in our results and recurring revenue growth rates. As we look ahead, we are in a great position to deliver long-term growth and profitability. I will now turn the call over to the operator for Q&A. Operator? At this time, I would like to remind everyone if you would like to ask a question, please press star then the number one on your telephone keypad. Your first question comes from the line of Saket Kalia with Barclays. Okay, great. Hey, good morning, guys, and thanks for taking my questions here. Hey, Saket. Good morning. Hey. Morning, Udi. Udi, maybe just to start with you. You know, it feels like you and the team have been talking about broader identity versus just privilege here a lot more recently. I was just wondering if you could just talk about how the non-privileged part of the business is doing. I know you touched on this in the prepared remarks but maybe just go one level deeper. How is the non-privileged part of the business doing with access and DevSecOps, for example? And to what extent do you think customers wanna buy both of these parts of the portfolio? Does that make sense? Yeah, yeah. Absolutely. Sure thing. I would say we're excited by the performance of all parts of the business and the fact that Privilege Cloud SaaS is leading the way. As I mentioned, identity security and our message is really resonating with customers. If you look at the other elements, what you're calling the non-privileged, first of all, we had EPM have a record quarter, this quarter and is proving to be also a new landing point or a landing spot for new customers and really gets also the drivers that are related to Zero Trust and ransomware. When we look at the access and DevSecOps speed boats, they have the power of both appealing to our existing customer base and that is resonating with the identity security message but also having that speed boat overlay effort that is getting them into new accounts and again into the upsell. More and more of our customers are buying the wide portfolio. I gave the example of the customer that bought all of our products. That is happening. I would say that in every conversation and pipeline build, it's across the entire portfolio. I think with some of the bundling, they're actually getting a taste of elements of access, for example, in early deals. I'm excited that you know, the Privileged Access Management piece is on fire and leads the way. With the customer loyalty, we have the opportunity to upsell and get those new landing spots. Got it. That's great. Josh, maybe for my follow-up for you. You know, it sounds like we're gonna exit the transition, you know, a quarter earlier than what you'd originally expected. Can you just remind us sort of what that means from a mix or anything o r from a mix perspective or just anything we need to keep in mind from a modelling perspective, just kinda given that earlier exit? Yeah. Thanks, Saket. You know, I mean, the main thing is that when we talk about transitioning out of you know into a fully subscription company, we're talking kind of put the threshold at when we get into you know past the 85% of our bookings coming from SaaS and subscription. So when we talk today about moving that quarter in from Q4 in the last call to now Q3, we're talking about kind of hitting that threshold of 85% or more subscription bookings coming from SaaS and subscription in the third quarter already. What that means is that you know you're continuing to see you know the percentage going to perpetual you know decreasing you know particularly you know over next year. Of course, there will be, after that, kind of a tail of the remaining perpetual business happening after that third quarter. It's really, you know, we set out a playbook at the beginning of the year and we're really glad to be able to keep improving on that playbook quarter in, quarter out. Absolutely. Thanks very much, guys. Thank you. Your next question comes from the line of Adam Borg with Stifel. Hey, guys. Thanks so much for taking the questions. Maybe just on Secure Web Sessions to start. It seems like an interesting product, and you talked about that in the prepared remarks. I was just curious, are there any particular users or verticals where you think something like this would be more demanded? No, absolutely. We're very excited about it. We see the proliferation of privilege that you have more and more cases where a business user is actually privileged and the organization is worried about having no control over the session. I would say one major part is IT-like functions in a business user, whether they're using HR applications or a business application like Salesforce or SuccessFactors and others b ut then also the folks using web sessions for administrative-like functions like the web consoles and others. So there are elements that are IT-like, and there are elements of business users. In terms of verticals, we actually see it applying across verticals, all companies. Of course, the more regulated will tend to wanna put those controls even faster. The beauty of it is that it can run on any single sign-on solution. It doesn't have to just attach to CyberArk, and it gives us the opportunity to sell the solution and apply these PAM-like controls to all companies across the board that even have identity management in place. That's really helpful. Maybe just as a quick follow-up, you know, in the slide deck, you talk about the bookings by vertical and it's just interesting to see that over the last several quarters, you know, banking and financials, it becomes a smaller part of the mix as other areas are growing faster and manufacturing stands out. I'd love to hear more about what's leading to the success you're seeing in some of what I'll call your less traditional verticals. Thanks again. No, absolutely. I think historically, CyberArk saw the more regulated verticals jumping into the fray earlier. The trend over the last couple of years is that privileged access management and identity security are considered best practice across all verticals. You see a catch-up. This quarter, we saw the energy vertical, global government, manufacturing more than double. I would say we continue to be applicable to all verticals. There are some verticals that are in a faster catch-up mode. Of course, we have a very strong customer base in the financial sector and that will continue. Your next question comes from the line of Hamza Fodderwala with Morgan Stanley. Hey, guys. Thanks for taking my question. Udi, first question for you. I was wondering if you could comment a little bit about the growth and opportunity you're seeing in machine-to-machine identity in particular, just given the rise of the open source tools. Any sort of comment there? Yeah. I wanted to add on to my earlier answer before, where I talked a lot about the opportunity in our access trust platform that very much in the secrets management world, there's growing awareness definitely after SolarWinds and like you mentioned, the proliferation of the DevOps pipeline as the place where attackers are going after. If you stole a human secret or if you stole a strong machine-to-machine type secret, you can get you know, similar access or even deeper. It's definitely applicable to all companies and we're seeing that grow. We see more and more customers also want to leverage the fact that they can buy our secrets management solution and leverage Privilege Cloud as a solution to attach to. Of course, a lot of the self-hosted customers are expanding to secrets management and will now consume this in the subscription model. You're right. It's a growing trend where there's a proliferation of secrets across applications and machines. If we had these special glasses, we would see a big proliferation of credentials on the human side but an even faster and probably out of control on the development side and on the application side and we're going after it. Just a quick follow-up for Josh Siegel. On the ARR, how should we think about the plus and take with subscription versus maintenance? Obviously, maintenance is gonna be a bit of a drag just given the transition. Like how should we think about kind of modelling that over the next few quarters? Yeah, absolutely. We're gonna see, you know, still very high growth on the subscription piece of the ARR that we've been seeing. We saw it grow to 131% in the third quarter. And maintenance off the perpetual will kind of continue to trend kind of flat a nd then at some point, you know, as we get to the transition quarter, we'll start to could go potentially minus, you know, sequentially. I think the way we kind of look at it is we can consider already the subscription piece of the ARR business already crossing over the 50% in the, you know, the first half of next year. Today it's around 40% of the total ARR and growing to more than 50% of it in the first half of next year. In terms of the exact, you know, timing of when the maintenance will start to go negative, it's later on in next year and it really depends on the mix rate. Super helpful. Thank you. Your next question comes from the line of Rob Owens with Piper Sandler. Rob Owens? Mr. Owens, your line is open, sir. Your next question comes from the line of Brian Essex with Goldman Sachs. Hey, great. Thank you very much. Thank you for taking the question and great to see the acceleration and results. I was wondering if I could follow up on Hamza's question, actually. You know, fourth Q has historically been a relatively heavy perpetual license quarter. So maybe if you could give us a little bit more color around what the previous changes in incentive compensations to skew the efforts towards SaaS, what the impact is with regard to what you typically see or have typically seen on the perpetual side. Then how do we think about progress with the install base with regard to kind of transitioning to SaaS? What do you see in your pipeline and, you know, maybe any anything you can call out with regard to potential volatility on a perpetual side in fourth Q? Brian, I'll start with your second piece. I think the way- Okay. The way we approach this transition was always do right by the customer and follow the trend. I think we were even surprised like I alluded to, that the existing self-hosted customers are embracing and without us having to push them, they see that as part of their roadmap. You see that in the right timing, they also consider and look for ways to adopt our Privilege Cloud solution. Some examples, and like I gave in the script, are some very large CyberArk customers that were self-hosted that bought our Privilege Cloud for new business units or for M&A, where they wanna put these controls fast and up and running quickly. They'll, and others are excited to adopt other SaaS solutions like our EPM or Identity and look at Privilege Cloud as the solution as they start to downsize their data center, but we will allow them to do it in the right time for them. Of course every new solution out here has been SaaS, and we're seeing those adopted. In terms of the incentive, we of course put out the program at the beginning of the year, incentivizing the team to sell SaaS and subscription. With that, always do right by the customer. Existing customers that have add-on business lined up for Q4, we're definitely expecting that. Yeah. I'll add, Brian. You know, in addition to what Udi just said, we set out a clear playbook for transitioning and it included the incentives to the sales teams, as Udi just pointed out. It also included a full-blown education package of how do we move through, you know, going from selling perpetual to selling to SaaS and subscription. For this year, we're really focused on incentivizing them to quote and to create new pipeline on the SaaS and subscription, which, you know, has been definitely happening for us. We see the majority of our new pipeline coming out as SaaS and subscription. I think it's also indicative when we look at 85% of our new logos from the third quarter were SaaS or a subscription-based new logos. Specifically around Q4, we do anticipate seeing a m ore perpetual business in Q4. It's not really related to our compensation or incentive plans. It's just that Q4 is our largest quarter, and also we sell to enterprises, so there's typically budget flush and deals that are opening and closing in the fourth quarter and those will be to be more add-on deals that with existing customers and adding on more licenses in their current install base which is most likely going to be a perpetual install base. We do expect to see in the fourth quarter a tick up in perpetual but then again, as we go into next year, we'll start to see more and more in SaaS and subscription because most of the new pipeline this year has been created in SaaS and subscription. That hence our ability to move up our target to the third quarter of getting over 85%. Got it. That's helpful. Maybe just real quick for a follow-up. Given the pull forward in, you know, expectation for completion of your transition, you know, thoughts on the, how you think about spending. I mean, you know, great innovation on the platform. We see the elevated R&D costs. Sales and marketing spend is, you know, also elevated relative to historical growth rates b ut how do you think about, you know, when we might start to see an inflection back to kind of, you know, double-digit profitability, you know, operating margins and better profitability given the shift in timeline forward? Yeah. You know, I think it's basically a shift. I mean, you know, the way the mechanics work in a transition is going to be, you know, all the way through the transition quarter, and the next one following is usually the trough of the operating margins. Then you start to see some slow increasing, you know, one to two quarters after you're through the transition. You know, the earlier, you know, the faster we bring in the transition, the faster we can get back there. We can't control the fact that going through the transition to the end of, you know, that quarter, it's still going to take one to two quarters afterwards before we start to see it rising from there. The rise is not going to be in a single quarter. It's going to be gradual over several quarters post that transition. Okay. Very helpful. Thank you. Your next question comes from the line of Jonathan Ho with William Blair. Hi, good morning. Just wanted to, I guess, start with EPM. Just given the success that you're seeing there, is there any change to your thinking around how large, EPM could be as a product area? Just wanna get a sense for that. Jonathan, it's one of the areas where we're again. They're all our children, so we're excited about all of them. EPM is one of those. It's a best practice of reducing risk and removing least privilege but it also is very effective against ransomware. We think the opportunity is great. We finally got to a point where the awareness is there for us to further step on the gas and leverage this growth engine. I'm not gonna, you know, we're not gonna refine the TAM numbers we put out there because we saw this opportunity but it is maturing and like I said, becoming a mainstream awareness of a strong and important control to put in place both as part of a wider privileged access management program but also standalone. We've put things in place that also bring it more as a landing spot for us, both in how our sales team works but also the type of channels that are expanding and taking us there and even down to the mid-market with channels like CDW that can bring this into the mid-market. Your next question comes from the line of Jonathan Ruykhaver with Baird. Yeah. Good morning, and congrats on the strong performance. Udi, it's great to see the success you're witnessing with Privilege Cloud. I'm wondering if you could talk a little bit more detail about the adoption trends you're seeing in terms of new customer acquisition versus install base expansion and what you're seeing in terms of those adoption trends across commercial versus large enterprise? Yeah. I would say that, you know, we're very excited to see the acceleration in the new logos. Part of that is the solutions are more relevant than before. The attack surface is expanding, and we've built this record pipeline over the past 18 months that we're converting. I think we're seeing in the new logos more landing spots with EPM, and of course with Access and with PAM. The speedboat structure really provides more subject matter experts to take the opportunity. As I mentioned before, we have been investing in the channel and the channel programs and those are paying off for those landings. Those include CDW but they also include doing more with AWS and others. Now with regards to enterprise versus commercial, if I understood, it's really going after both. Enterprise has been our sweet spot but with these expanded channels, we're able to go further down market. It's moving from the highly regulated to the less regulated part of the mid-market which is exciting. Maybe you can talk about that push in the commercial. Where are you in terms of driving that enablement among your channel partners? Is this something that becomes, you know, more material as a driver to bookings as we look into 2022? I think we wanna excel in both. Enterprise is the holy grail for CyberArk, is where we're coming from and we have the strongest customer base. We saw that we can double down our efforts on the commercial without distracting the enterprise focus. Again, because it's incremental types of channels and a focused team that is going after the commercial space. Yeah, you'll see it continue to be a major source of growth. Of course, the larger deals and the larger ASP is coming from the enterprise part of the business which is really embracing the identity security messaging and appreciating the innovation we've put in place. Your next question comes from the line of Roger Boyd with UBS. Hi, thank you for taking my questions. I was wondering if you could talk a little more about the Idaptive customer base and what you're seeing out of these customers in terms of their willingness to upsell to PAM and just general recognition of your strategy of a privileged access-centered identity security strategy. Yeah, absolutely. I think the biggest motion is upselling the PAM customers on the access and our DevSecOps and secrets management. That's the majority of our 7,000 customers and we form those deep relationships where they're happy to explore covering that proliferation of privilege into workforce users, into their suppliers, into the third party elements and to secrets management. The motion of the pure Idaptive customers from the acquisition, the most important piece over the last year was to make sure they're happy and growing, and then also introduce additional elements to them on the PAM side. Like I said, the bigger motion is expanding with our PAM customers across the portfolio. Your next question comes from the line of Gregg Moskowitz with Mizuho. Okay, thank you for taking the question. Congratulations on a very good quarter. Udi, I know that existing customers have a loyalty incentive to move to SaaS, and with all the success that you're seeing with respect to the overall subscription transition, I'm wondering if you're also seeing more migrations from on-premise to SaaS. Thanks. Okay, yeah. We incentivize obviously our salespeople but the number one thing is to follow the plan and allow the customers to execute the strategy in their pace b ut of course, they see the new bundled packages, and that's incentivizing them to look at our subscription which really, even if they're an on-premise customer, to get more value with add-on business coming in with the subscription packages. The move from it for an on-prem customer to move to SaaS is more gradual among the enterprises. We find ourselves pleasantly surprised by some of the examples I gave in the Fortune 30, a customer that more and more enterprises are also migrating and taking on Privilege Cloud. We'll see that as a pathway over the year, the coming years. One of the strength of CyberArk is really giving customers optionality on how to consume the identity security portfolio. Your next question comes from the line of Rob Owens with Piper Sandler. Great. Thank you guys for taking my question, and I apologize for the technical difficulties earlier. I swear it wasn't user error, so. Udi, in your prepared remarks you talked about SaaS driving more users and driving more users faster. Is that a SaaS adoption comment or is this a democratization of privilege by SaaS and the fact that there's broader applicability now, especially given the attack surface? I think we're seeing the classic benefits of SaaS where there's quicker time to value. A customer does not have to install and go through the process of taking care of the infrastructure. We deliver success packages. They get up and running, they see it's working, it gave them both security but also the ability to manage their infrastructure faster. You have a faster path to the upsell of more users of Privilege Cloud or add-on business on other elements of the portfolio. I would say that the benefit of faster time to value, faster time to innovation and an overall quicker path to an add-on sale. It's all very real in CyberArk. We put the customer in the center and the entire organization is all about creating customer value. Your next question comes from the line of the Ittai Kidron with Oppenheimer. Hey, guys, great quarter. I guess now that you're getting close to the end of the transition, Udi, the big question is- You're gonna have a hardcore of customers who are still stuck on perpetual and what is it that you're gonna do about it? Meaning, are you going to terminate? What is the timeline by which you will stop offering perpetual and what are the odds that midpoint or late next year you actually raise prices on your maintenance in order to push that last bastion of customers into the subscription model? Yeah. I think our constitution puts the customer first, so that customer loyalty has really worked for us. I think it's gonna be much more on the carrot side versus the stick for them to see more value in the subscription packages, a taste of other elements of the portfolio as they pick up elements of the subscription packages. Overall, we're seeing that they are open to it, especially as they are on a maintenance renewal rate with CyberArk and are open to expand and take on the subscription packages. Of course, let's remember that maintenance is a great recurring revenue for us as well. The opportunity is out there to gradually bring them on to the subscription journey and definitely to lead with SaaS to the SaaS journey. That's the. To the prior questions, that's where they're gonna see even greater value in the transition. I don't know, Josh, if you want to add anything on. Yeah. I think you covered the points, and the main issue is as they add on more and more sales, they're going to be really incented because of our great subscription packages to kind of move their current install base to an add-on sales to be subscription-based. And it's also a form of a tech upgrade for them if they want to now reverse and get that same tech upgrade for their install base on perpetual. So, you know, we see it happening pretty naturally but there will be a tail once. It's happening naturally as we see it today. Your next question comes from the line of Catharine Trebnick with Cowen Securities. Oh, thanks for taking my question. Excellent quarter. Udi, could you try to quantify of the new business, how much is that really being driven by, the acceleration for organizations to really undertake Zero Trust architectures? Yeah, sure. Catharine, I couldn't give a number, but I would say that all the strong business drivers out there are business of Zero Trust and also the protection against ransomware are strong drivers for our business. Even in the executive order and in other elements, it's very clear that least privilege and putting time controls is really a basic tenet to achieve Zero Trust. I would say it's in every customer conversation, definitely at CIO and CISO level. They like the connection of how CyberArk with PAM at the center, but also the full identity security approach is part of them getting to a Zero Trust, or executing on a Zero Trust framework. It's a great driver on top of all the enablement we provide and, of course, the proactive protection they can get with our solution. I always want us to be enablement side because I think the beauty of this portfolio is that we both are a proactive security layer but we're also really allowing them to get digital transformation going and connect to their suppliers, connect their remote workforce, allow their IT to transform and modernize. So it's all part of the supporting tailwinds for us that Zero Trust frameworks are right out there. Your next question comes from the line of Joshua Tilton with Wolfe Research. Hey, guys. Thanks for taking my questions. For my first one, I was kinda hoping, when we think about the broader identity space, can you just comment on the demand environment but specifically compare and contrast the demand for privileged access management versus the demand for access management? Maybe how does this compare to six months or even a year ago? I talked about it. I would say a year ago, we didn't have this combined emotion of going after the existing customer base. I think we benefit from the two worlds right now where for a customer looking to put in that critical layer of privileged access management, CyberArk is the market leader, go to us. We have the go-to-market, the reach and the opportunity to really capture that demand. Demand is as strong and the strongest I can recall for privileged access management. Access is a new motion for us but it's a huge growing market because of the need to enable digital transformation and we can ride it and the way we're doing it is with very much centered on our customer base that trusts us on PAM. I would say they're both in strong demand. PAM is definitely the one that resonates the most with the CISO as a layer that they must have a need to present to the board. I would say even a basic pillar of their cybersecurity strategy. PAM is more cybersecurity driven. Our PAM customers trust us with the expansion to the rest of the portfolio. Access is the driver of digital transformation and enablement which is also here to stay. Your next question comes from the line of Imtiaz Koujalgi with Guggenheim Securities. Yes. Thanks for taking my question. Can you comment on your federal performance in this quarter and any products that shows strength in that vertical? Absolutely. I would say the federal for us was not. We didn't see the same levels of budget flush like in previous years. We mostly attribute that to the new administration and budget. The awareness is stronger than ever. I mentioned the executive order that touches elements of Zero Trust and least privilege. I would say a lot of engagement with various agencies and with our partners in the federal market. I can share that the global government vertical, if we look at it in a full bucket, grew more than 100% for us in Q3. It's very much led by Privileged Access Management as the major, I would say, grower in this segment where many agencies, governments still need to do the basics around Privileged Access Management. I also mentioned that the SLED vertical, The State and Local and Education vertical performed really well in the quarter. Your next question comes from the line of Mike Cikos with Needham & Company. Hey, guys. Thanks for squeezing me in here. First question, I just wanted to touch on the cross-sell motion. Obviously, we're talking about customers once they come to SaaS or subscription are incentivized to continue down that track with their add-on sales. Curious, do you guys have enough data at this point to give us a sense for that cross-sell motion where customers are typically going to next? Where are they congregating to within CyberArk's portfolio? It really varies. I would say that a pure PAM customer would typically expand the EPM as the kind of next stage of a PAM program. You've secured servers but you left your endpoints exposed with over privilege. It's kind of the next step in a cross-sell. I didn't mention earlier but we're also partnering with the EDR and the XDR companies to actually make it so that these fit the EPM and live together nicely with our partners on that front. From that front, if they're executing on a PAM or an identity program, there's the expansion to secrets management because it's the other side of privilege and securing their applications and then of course to access. I would say if I had to generalize, that would be a course for a PAM customer. In the new account, we're actually seeing that we can land with multiple products as again the awareness of both what's the best practice in PAM and the bundled elements of identity security we can land with more. At this time, I would like to turn the call back over to Mr. Udi Mokady for closing remarks. Thank you, Lisa. Thanks, everyone. I wanna thank our customers, partners, and employees for contributing to our strong third quarter and supporting our transition to a modern subscription company. I'm confident that as we execute our strategy, we will build even deeper relationships with our customers and partners. Thanks, everyone. This concludes today's conference. You may now disconnect.